Skip to content

Bump express to 4.16.2 to address forwarded vulnerability #1198

@tancnle

Description

@tancnle
  • Operating System: MacOS 10.13.1
  • Node Version: 8.9.1
  • NPM Version: 5.5.1
  • webpack Version:
  • webpack-dev-server Version: 2.9.4
  • This is a bug
  • This is a feature request
  • This is a modification request

Our most recent sourceclear scan (https://www.sourceclear.com/) has revealed a vulnerability in forwarded library which can cause regular expression denial of service (ReDoS). A flaw when the x-forwarded-for header is parsed causes the event loop to be blocked. To mitigate this, we need to bump forwarded to 0.1.2.

Dependency tree for express, before:

after:

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions